Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
-
Size
530KB
-
MD5
c91690d00774a8f5b6689511661a451b
-
SHA1
229f4ff7e0c1f48b844f170d2589055e5454ce7b
-
SHA256
46bb9cd05ae80855337ae7dd00459e2b2a046ba80580609daced13f081a9774a
-
SHA512
51a081909cf94e0ebdfcabe6e4338dc14884b04e84bb9b9fa45c4e7c2b2c78d4806c6f9a48a092d7cceff841966a8e6765b60af8111309b509e4e5325aa63121
-
SSDEEP
12288:AU5rCOTeioL0+lSoxyWpqkUG/rrudNZulFVg0M1:AUQOJoL0+lSHWpqkUir6dNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2948 2626.tmp 2508 2674.tmp 2640 26F1.tmp 2636 274F.tmp 2696 27CC.tmp 2692 2839.tmp 2312 2896.tmp 2596 28F4.tmp 2420 2952.tmp 2876 29AF.tmp 2892 2A0D.tmp 1188 2A6A.tmp 2708 2AB8.tmp 2756 2B06.tmp 2744 2B54.tmp 2152 2BC2.tmp 1432 2C1F.tmp 352 2C7D.tmp 772 2CDA.tmp 1288 2D48.tmp 780 2D86.tmp 2156 2DE4.tmp 2028 2E51.tmp 1996 2E8F.tmp 1936 2ECE.tmp 1724 2F1C.tmp 1548 2F5A.tmp 2068 2F98.tmp 2780 2FD7.tmp 2064 3025.tmp 1640 3063.tmp 1740 30A2.tmp 908 30E0.tmp 1800 311E.tmp 2356 315D.tmp 3056 319B.tmp 412 31E9.tmp 2364 3228.tmp 2940 3266.tmp 1448 32A4.tmp 848 32E3.tmp 1304 3321.tmp 356 3360.tmp 1684 339E.tmp 920 33DC.tmp 616 341B.tmp 2868 3469.tmp 2852 34A7.tmp 2340 34E6.tmp 568 3524.tmp 1364 3553.tmp 1668 3591.tmp 1536 35DF.tmp 2080 361E.tmp 2320 365C.tmp 1508 369A.tmp 2492 36D9.tmp 2584 3717.tmp 2632 3756.tmp 2556 3794.tmp 2648 37D2.tmp 2524 3811.tmp 2528 3840.tmp 2696 387E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2700 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 2948 2626.tmp 2508 2674.tmp 2640 26F1.tmp 2636 274F.tmp 2696 27CC.tmp 2692 2839.tmp 2312 2896.tmp 2596 28F4.tmp 2420 2952.tmp 2876 29AF.tmp 2892 2A0D.tmp 1188 2A6A.tmp 2708 2AB8.tmp 2756 2B06.tmp 2744 2B54.tmp 2152 2BC2.tmp 1432 2C1F.tmp 352 2C7D.tmp 772 2CDA.tmp 1288 2D48.tmp 780 2D86.tmp 2156 2DE4.tmp 2028 2E51.tmp 1996 2E8F.tmp 1936 2ECE.tmp 1724 2F1C.tmp 1548 2F5A.tmp 2068 2F98.tmp 2780 2FD7.tmp 2064 3025.tmp 1640 3063.tmp 1740 30A2.tmp 908 30E0.tmp 1800 311E.tmp 2356 315D.tmp 3056 319B.tmp 412 31E9.tmp 2364 3228.tmp 2940 3266.tmp 1448 32A4.tmp 848 32E3.tmp 1304 3321.tmp 356 3360.tmp 1684 339E.tmp 920 33DC.tmp 616 341B.tmp 2868 3469.tmp 2852 34A7.tmp 2340 34E6.tmp 568 3524.tmp 1364 3553.tmp 1668 3591.tmp 1536 35DF.tmp 2080 361E.tmp 2320 365C.tmp 1508 369A.tmp 2492 36D9.tmp 2584 3717.tmp 2632 3756.tmp 2556 3794.tmp 2648 37D2.tmp 2524 3811.tmp 2528 3840.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2948 2700 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 28 PID 2700 wrote to memory of 2948 2700 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 28 PID 2700 wrote to memory of 2948 2700 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 28 PID 2700 wrote to memory of 2948 2700 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 28 PID 2948 wrote to memory of 2508 2948 2626.tmp 29 PID 2948 wrote to memory of 2508 2948 2626.tmp 29 PID 2948 wrote to memory of 2508 2948 2626.tmp 29 PID 2948 wrote to memory of 2508 2948 2626.tmp 29 PID 2508 wrote to memory of 2640 2508 2674.tmp 30 PID 2508 wrote to memory of 2640 2508 2674.tmp 30 PID 2508 wrote to memory of 2640 2508 2674.tmp 30 PID 2508 wrote to memory of 2640 2508 2674.tmp 30 PID 2640 wrote to memory of 2636 2640 26F1.tmp 31 PID 2640 wrote to memory of 2636 2640 26F1.tmp 31 PID 2640 wrote to memory of 2636 2640 26F1.tmp 31 PID 2640 wrote to memory of 2636 2640 26F1.tmp 31 PID 2636 wrote to memory of 2696 2636 274F.tmp 32 PID 2636 wrote to memory of 2696 2636 274F.tmp 32 PID 2636 wrote to memory of 2696 2636 274F.tmp 32 PID 2636 wrote to memory of 2696 2636 274F.tmp 32 PID 2696 wrote to memory of 2692 2696 27CC.tmp 33 PID 2696 wrote to memory of 2692 2696 27CC.tmp 33 PID 2696 wrote to memory of 2692 2696 27CC.tmp 33 PID 2696 wrote to memory of 2692 2696 27CC.tmp 33 PID 2692 wrote to memory of 2312 2692 2839.tmp 34 PID 2692 wrote to memory of 2312 2692 2839.tmp 34 PID 2692 wrote to memory of 2312 2692 2839.tmp 34 PID 2692 wrote to memory of 2312 2692 2839.tmp 34 PID 2312 wrote to memory of 2596 2312 2896.tmp 35 PID 2312 wrote to memory of 2596 2312 2896.tmp 35 PID 2312 wrote to memory of 2596 2312 2896.tmp 35 PID 2312 wrote to memory of 2596 2312 2896.tmp 35 PID 2596 wrote to memory of 2420 2596 28F4.tmp 36 PID 2596 wrote to memory of 2420 2596 28F4.tmp 36 PID 2596 wrote to memory of 2420 2596 28F4.tmp 36 PID 2596 wrote to memory of 2420 2596 28F4.tmp 36 PID 2420 wrote to memory of 2876 2420 2952.tmp 37 PID 2420 wrote to memory of 2876 2420 2952.tmp 37 PID 2420 wrote to memory of 2876 2420 2952.tmp 37 PID 2420 wrote to memory of 2876 2420 2952.tmp 37 PID 2876 wrote to memory of 2892 2876 29AF.tmp 38 PID 2876 wrote to memory of 2892 2876 29AF.tmp 38 PID 2876 wrote to memory of 2892 2876 29AF.tmp 38 PID 2876 wrote to memory of 2892 2876 29AF.tmp 38 PID 2892 wrote to memory of 1188 2892 2A0D.tmp 39 PID 2892 wrote to memory of 1188 2892 2A0D.tmp 39 PID 2892 wrote to memory of 1188 2892 2A0D.tmp 39 PID 2892 wrote to memory of 1188 2892 2A0D.tmp 39 PID 1188 wrote to memory of 2708 1188 2A6A.tmp 40 PID 1188 wrote to memory of 2708 1188 2A6A.tmp 40 PID 1188 wrote to memory of 2708 1188 2A6A.tmp 40 PID 1188 wrote to memory of 2708 1188 2A6A.tmp 40 PID 2708 wrote to memory of 2756 2708 2AB8.tmp 41 PID 2708 wrote to memory of 2756 2708 2AB8.tmp 41 PID 2708 wrote to memory of 2756 2708 2AB8.tmp 41 PID 2708 wrote to memory of 2756 2708 2AB8.tmp 41 PID 2756 wrote to memory of 2744 2756 2B06.tmp 42 PID 2756 wrote to memory of 2744 2756 2B06.tmp 42 PID 2756 wrote to memory of 2744 2756 2B06.tmp 42 PID 2756 wrote to memory of 2744 2756 2B06.tmp 42 PID 2744 wrote to memory of 2152 2744 2B54.tmp 43 PID 2744 wrote to memory of 2152 2744 2B54.tmp 43 PID 2744 wrote to memory of 2152 2744 2B54.tmp 43 PID 2744 wrote to memory of 2152 2744 2B54.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"66⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"67⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"68⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"69⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"70⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"71⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"72⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"73⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"74⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"75⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"76⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"77⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"78⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"79⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"80⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"81⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"82⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"83⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"84⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"85⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"86⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"87⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"88⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"89⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"90⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"91⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"93⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"94⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"95⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"96⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"97⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"98⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"99⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"100⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"102⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"103⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"104⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"105⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"106⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"107⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"108⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"109⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"110⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"111⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"112⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"113⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"114⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"115⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"116⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"117⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"118⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"119⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"120⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"121⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-